6 ms·

The security improvement I want is that when I run ‘ps ax’ on a fresh install, I have reduced attack surface instead of dozens of random daemons hardwired into

The security improvement I want is that when I run ‘ps ax’ on a fresh install, I have reduced attack surface instead of dozens of random daemons hardwired into launchd like the one for classrooms(??), iCloud and photo sharing even when those features are disabled, etc.

walterbell 5y ago
Can those daemons be deleted/renamed?
- saagarjha 5y ago
  Not with SIP engaged.
  - yehaaa 5y ago
    Why is it not possible to disable SIP, make the desired changes, compute a new seal, then enable SIP again?
    - xgbi 5y ago
      Because if you can do it, any rootkit will be able to do it too.
      - yehaaa 5y ago
        But you disable SIP while booted in recover mode. Somehow Apple needs to do this anytime the system is updated.
      - Wowfunhappy 5y ago
        No it can't. You'd have to disable SIP temporarily in the first place, and a rootkit can't boot a recovery environment while SIP is engaged. And then on Apple Silicon Macs, entering 1TR is tied to the physical action of holding down the power button.
    - Wowfunhappy 5y ago
      I kind of bailed on macOS prior to Big Sur, so I'm not sure—but I think you can do that. Authenticated-root would need to be kept turned off, but that's a separate thing. You're going to have to redo everything after every update, however.
- tobylane 5y ago
  LaunchControl’s ui looks like it could disable them, but I haven’t tried.
  - djxfade 5y ago
    LaunchControl has a UI?
musicale 5y ago
This is a big issue - on Windows you can set services to not start up unless they are needed, and you can turn them off so they don't run at all. On macOS, the launchd configuration seems to be hard-wired and protected by SIP; there's no easy way to disable random daemons for features like remote student device management - something that most users would not need or want. And as you note even if you disable the associated feature (e.g. in Preferences) its daemon can still run. It's always annoying when you're not doing anything but your laptop heats up and turns on the fans because some stupid daemon has woken up and decided to re-scan the same files (such as game updates) for the 100th time. Not to mention photoanalysisd, which burns large amounts of CPU for days/weeks and runs even if you disable the intrusive and obnoxious holiday events/memories features in Photos.
- userbinator 5y ago
  photoanalysisd Does anyone else wonder what exactly it is analysing now, after the whole CSAM thing came to light?
  - kalleboo 5y ago
    The CSAM thing "came to light"? They announced it publicly and proudly, before it was even implemented! There's no reason to think they are hiding anything.
    - dannyw 5y ago
      The code for this was found in iOS 14.3, just in an inactivated state.
  - peakaboo 5y ago
    It boils down to using Linux if you want privacy.
  - duskwuff 5y ago
    Apple's Photos app can search photos based on their contents (e.g. try typing "cat" into the Photos search box). It can also identify individual faces, and group photos based on who's in them. All of this is local-only. (Which is why it has to run an expensive indexing process locally.)

walterbell 5y ago

Can those daemons be deleted/renamed?

saagarjha 5y ago
Not with SIP engaged.
- yehaaa 5y ago
  Why is it not possible to disable SIP, make the desired changes, compute a new seal, then enable SIP again?
  - xgbi 5y ago
    Because if you can do it, any rootkit will be able to do it too.
    - yehaaa 5y ago
      But you disable SIP while booted in recover mode. Somehow Apple needs to do this anytime the system is updated.
    - Wowfunhappy 5y ago
      No it can't. You'd have to disable SIP temporarily in the first place, and a rootkit can't boot a recovery environment while SIP is engaged. And then on Apple Silicon Macs, entering 1TR is tied to the physical action of holding down the power button.
  - Wowfunhappy 5y ago
    I kind of bailed on macOS prior to Big Sur, so I'm not sure—but I think you can do that. Authenticated-root would need to be kept turned off, but that's a separate thing. You're going to have to redo everything after every update, however.
tobylane 5y ago
LaunchControl’s ui looks like it could disable them, but I haven’t tried.
- djxfade 5y ago
  LaunchControl has a UI?

musicale 5y ago

This is a big issue - on Windows you can set services to not start up unless they are needed, and you can turn them off so they don't run at all. On macOS, the launchd configuration seems to be hard-wired and protected by SIP; there's no easy way to disable random daemons for features like remote student device management - something that most users would not need or want. And as you note even if you disable the associated feature (e.g. in Preferences) its daemon can still run. It's always annoying when you're not doing anything but your laptop heats up and turns on the fans because some stupid daemon has woken up and decided to re-scan the same files (such as game updates) for the 100th time. Not to mention photoanalysisd, which burns large amounts of CPU for days/weeks and runs even if you disable the intrusive and obnoxious holiday events/memories features in Photos.

userbinator 5y ago
photoanalysisd Does anyone else wonder what exactly it is analysing now, after the whole CSAM thing came to light?
- kalleboo 5y ago
  The CSAM thing "came to light"? They announced it publicly and proudly, before it was even implemented! There's no reason to think they are hiding anything.
  - dannyw 5y ago
    The code for this was found in iOS 14.3, just in an inactivated state.
- peakaboo 5y ago
  It boils down to using Linux if you want privacy.
- duskwuff 5y ago
  Apple's Photos app can search photos based on their contents (e.g. try typing "cat" into the Photos search box). It can also identify individual faces, and group photos based on who's in them. All of this is local-only. (Which is why it has to run an expensive indexing process locally.)